Federal regulators issue proposed third-party risk management guidance and community bank policy statement

WASHINGTON — Federal financial regulators issued proposed guidance on third-party risk management on Sept. 11, 2026, alongside a separate policy statement addressing how community banks engage with core service providers.

The coordinated regulatory action establishes new parameters for financial institutions outsourcing operational functions to outside vendors. The proposals impact commercial banks and credit unions managing complex vendor ecosystems, requiring a review of existing contracts, due diligence protocols, and ongoing monitoring frameworks across the sector.

Full details of the proposed rules and the associated supervisory statements are available via the Federal Reserve press release issued on Sept. 11, 2026.

Strategic Context

Financial institutions rely on external technology vendors, cloud providers, and specialized firms to handle core processing, compliance, and infrastructure. This vendor dependency has drawn scrutiny from supervisors examining operational resilience and systemic vulnerabilities across the banking sector.

The proposed guidance sets supervisory expectations for identifying, measuring, monitoring, and controlling risks associated with third-party relationships throughout their lifecycle. Concurrently, the statement on community bank engagement addresses operational challenges faced by smaller institutions that navigate contract negotiations with core service providers.

Forward Outlook

Bank operators and compliance officers face a designated public comment period to review the proposed standards and submit feedback on their operational impact. Institutions must evaluate their current vendor management systems against the proposed expectations, focusing on contract renegotiation, performance oversight, and contingency planning for critical technology disruptions. Risk managers will monitor the rulemaking process to gauge potential compliance requirements and determine how the finalized guidance affects community lenders relative to larger institutions.